Illinois Appellate Court Narrows Third-Party BIPA Liability

Why It Matters

The ruling limits BIPA risk for staffing agencies, clarifying that conduit‑type activities alone do not trigger liability, which could reduce costly litigation in the biometric‑data space.

Key Takeaways

• Staffing agencies not liable for Section 15(b) without data possession
• Court emphasizes acquisition, not mere facilitation, for BIPA liability
• Summary judgment upheld; discovery denied as unnecessary
• Employers must still ensure proper notice and consent
• Third‑party vendors retain exclusive biometric data possession

Pulse Analysis

Since its enactment in 2008, Illinois' Biometric Information Privacy Act has become a lightning rod for class actions, especially against employers that use fingerprint time clocks. Plaintiffs routinely allege violations of Section 15(b), which requires written notice and a written waiver before any biometric identifier is collected, stored, or otherwise obtained. The resulting judgments often reach seven figures, prompting companies to scrutinize every point of data capture. Staffing agencies, which place workers at client sites that operate biometric devices, have faced uncertainty about whether their role as intermediaries creates BIPA exposure.

The Illinois Appellate Court’s ruling in Salinas v. Arthur Schuman Midwest clarifies that liability under Section 15(b) hinges on actual acquisition of biometric data, not merely facilitating another entity’s collection. The court found that the staffing agencies had only ministerial access—enrolling employees and monitoring hours—while the client facility and its third‑party vendor retained exclusive possession of the fingerprint templates. By interpreting the statute as regulating “acquisition” rather than “proximity,” the judges affirmed summary judgment for the agencies and rejected the plaintiffs’ argument that conduit behavior alone suffices for liability.

For businesses operating in Illinois, the decision narrows the risk landscape but does not eliminate compliance obligations. Employers must still provide clear notice, obtain written consent, and implement robust data‑security policies whenever they directly collect or store biometric identifiers. Staffing agencies should review contracts with client facilities and third‑party vendors to confirm that data possession remains with the latter, and they may consider adding indemnification clauses to shift liability. As courts continue to interpret BIPA, proactive policy audits and transparent communication with workers remain the best defense against costly litigation.